Symantec企业产品知识库文章--EndpointProtection

.....................................................................................................................................................PAGE.................................................PAGE21...................................................................................................PAGESymantec企业产品知识库HYPERLINK"http://www.symantec.com/business/support/index?page=products"http://www.symantec.com/business/support/index?page=productsEndpointProtectionHYPERLINK"http://www.symantec.com/business/support/index?page=content&key=54619&channel=TECHNICAL_SOLUTION"http://www.symantec.com/business/support/index?page=content&key=54619&channel=TECHNICAL_SOLUTIONHYPERLINK"http://www.symantec.com/"Symantec.com>HYPERLINK"http://www.symantec.com/business"Business>HYPERLINK"http://www.symantec.com/business/support/index?page=home"Support>HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=54619"搜索结果>KB文章不受控管的SEP客户端定制升级定义失败，但是手动升级没有问题文章:TECH157766|创建日期:2011-04-11|更新日期:2011-04-11文章类型TechnicalSolution产品HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=54619"EndpointProtection->11.0语言中文(简体)(Simp.Chinese)Problem检查所有的权限问题，都不能解决此问题。它只发生在win2000服务器上。手动点击升级或者运行luall，都能够正常升级定义。但是定制的定义升级，没有运行。Environmentwin2000.VersionunderSEPru6Mp2Solution这个问题已经提交给研发，请查看Etrack2329484获得最新的更新和方案。文章URLhttp://www.symantec.com/docs/TECH157766赛门铁克端点保护(SEP11)客户端安装失败，提示消息“SymantecEndpointProtection到需要重新启动的挂起系统更改，请重新启动系统并重新运行安装”文章:TECH146653|创建日期:2010-12-21|更新日期:2011-03-11文章类型TechnicalSolution产品HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=54619"EndpointProtection->11.0->11.0RU5->11.0RU5(HostedEndpoint)语言中文(简体)(Simp.Chinese)Problem在安装赛门铁克端点保护(SEP11)客户端时系统提示：“SymantecEndpointProtection检测到需要重新启动的挂起系统更改，请重新启动系统并重新运行安装”。安装中止，重新启动计算机并重新安装SEP客户端，仍然提示该错误信息。ErrorSolution打开Windows注册表编辑器（Regedit.exe），浏览到以下注册表项：HKEY_LOCAL_MACHINE\sytem\CurrentControlSet\Control\SessionManger。在右侧的面板寻找是否存在该字符串值：PendingFileRenameOperations。如果您没有找到该字符串值，继续在以下位置寻找：HKEY_LOCAL_MACHINE\System\ControlSetXXX\Control\SessionManager\PendingFileRenameOperations。右键单击包含该值的注册表项SessionManager，然后选择导出并保存。从注册表中删除PendingFileRenameOperations值。重新启动计算机并重新安装SEP。文章URLhttp://www.symantec.com/docs/TECH146653如何防护W32.Stuxnet?文章:TECH142348|创建日期:2010-10-21|更新日期:2011-03-11文章类型TechnicalSolution产品HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=51852"AntiVirusCorporateEdition->10.0->10.0MR2MP2(10.0.2.2)HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=51852"AntiVirusCorporateEdition->10.0->10.0MR2MP1(10.0.2.1)HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=51852"AntiVirusCorporateEdition->10.0->10.2HYPERLINK"javascript:;"显示全部HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=51852"AntiVirusCorporateEdition->10.0->10.1HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=51852"AntiVirusCorporateEdition->10.0->10.0MR2(10.0.2)HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=51852"AntiVirusCorporateEdition->10.0->10.0MR1(10.0.1)HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=54619"EndpointProtection->11.0HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=51852"AntiVirusCorporateEdition->10.0->10.0MR1MP1(10.0.1.1)HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=51852"AntiVirusCorporateEdition->10.0->10.2MR2(10.2.2)HYPERLINK"javascript:;"显示部分主题Security/Threat语言中文(简体)(Simp.Chinese)Problem如何防护W32.Stuxnet?Solution1.Symantec什么时候开始检测到此病毒？W32.StuxnetwasfirstcategorizedinJulyof2010.OriginallySymantecnamedthedetectionW32.TemphidbasedupontheinformationoriginallyreceivedbutlaterrenameditStuxnettobringournamingconventioninlinewithothervendors,andthereforevirusdefinitionsdatedJuly19,2010orearliermaydetectthisthreatasW32.Temphid.2.W32.Stuxnet如何传播？1)利用微软漏洞：-MicrosoftWindowsShortcut'LNK/PIF'FilesAutomaticFileExecutionVulnerability-MicrosoftWindowsServerServiceRPCHandlingRemoteCodeExecutionVulnerability-MicrosoftWindowsPrintSpoolerServiceRemoteCodeExecutionVulnerability2)网络共享；3)U盘。3.W32.Stuxnet有什么危害？Stuxnetsearchesforindustrialcontrolsystems,oftengenerically(butincorrectly)knownasSCADAsystems,andifitfindsthesesystemsonthecompromisedcomputer,itattemptstostealcodeanddesignprojects.ItmayalsotakeadvantageoftheprogrammingsoftwareinterfacetoalsouploaditsowncodetotheProgrammableLogicControllers(PLC),whichare‘mini-computers’,inanindustrialcontrolsystemthatistypicallymonitoredbySCADAsystems.4.有哪些操作系统受到W32.Stuxnet的影响？Ourin-fielddatashowsthatmultipleversionsofWindowsareseeingthesemaliciousfiles.However,notallversionsmaybevulnerabletotheexploitbeingused.5.如何防护W32.Stuxnet？1)更新微软相关补丁：-MicrosoftWindowsShortcut'LNK/PIF'FilesAutomaticFileExecutionVulnerabilityHYPERLINK"http://www.microsoft.com/technet/security/bulletin/MS10-046.mspx"http://www.microsoft.com/technet/security/bulletin/MS10-046.mspx-MicrosoftWindowsServerServiceRPCHandlingRemoteCodeExecutionVulnerabilityHYPERLINK"http://www.microsoft.com/technet/security/bulletin/ms08-067.mspx"http://www.microsoft.com/technet/security/bulletin/ms08-067.mspx-MicrosoftWindowsPrintSpoolerServiceRemoteCodeExecutionVulnerabilityHYPERLINK"http://www.microsoft.com/technet/security/bulletin/ms10-061.mspx"http://www.microsoft.com/technet/security/bulletin/ms10-061.mspx2)使用Symantec专门提供的的应用程序和设备控制策略：下载并导入以下ADC策略：HYPERLINK"http://www.symantec.com/avcenter/security/ADC/CVE-2010-2568.dat"http://www.symantec.com/avcenter/security/ADC/CVE-2010-2568.dat具体使用方法如下：Tousethepolicy,HYPERLINK"http://service1.symantec.com/SUPPORT/ent-security.nsf/docid/2008110606154848?Open&seg=ent"importthe.datfileintoyourSymantecEndpointProtectionManager.Whendistributingittoclientcomputers,werecommendusingitinTest(logonly)modeinitiallyinordertodeterminethepossibleimpactsofthepolicyonnormalnetwork/computerusage.Afterobservingthepolicyforaperiodoftime,anddeterminingthepossibleconsequencesofenablingitinyourenvironment,deploythepolicyinProductionmodetoenableactiveprotection.FormoreinformationonADCandhowtomanageanddeploythemthroughoutyourorganization,pleaserefertotheHYPERLINK"ftp://ftp.entsupport.symantec.com/pub/support/documentation/Administration_Guide_SEP11.0.6.pdf"SymantecEndpointProtectionAdministrationManual(PDF).3)关闭系统还原、及时更新病毒定义并进行全面扫描；ThelatestIntelligentUpdatervirusdefinitionscanbeobtainedhere:HYPERLINK"http://securityresponse.symantec.com/avcenter/defs.download.html"IntelligentUpdatervirusdefinitions.Fordetailedinstructionsreadthedocument:HYPERLINK"http://service1.symantec.com/SUPPORT/nav.nsf/docid/1998082013035306?OpenDocument&src=sec_doc_nam"HowtoupdatevirusdefinitionfilesusingtheIntelligentUpdater.4)更新IPS：为了防护此病毒的传播，Symantec已经发布以下IPS进行防护：-HTTPW32StuxnetCCActivity（SID:23791）HYPERLINK"http://www.symantec.com/business/security_response/attacksignatures/detail.jsp?asid=23791"http://www.symantec.com/business/security_response/attacksignatures/detail.jsp?asid=23791-HTTPW32StuxnetCCActivity1（SID:23792）HYPERLINK"http://www.symantec.com/business/security_response/attacksignatures/detail.jsp?asid=23792"http://www.symantec.com/business/security_response/attacksignatures/detail.jsp?asid=237925)删除相关的注册表：Important:Symantecstronglyrecommendsthatyoubackuptheregistrybeforemakinganychangestoit.Incorrectchangestotheregistrycanresultinpermanentdatalossorcorruptedfiles.Modifythespecifiedsubkeysonly.Forinstructionsrefertothedocument:HYPERLINK"http://service1.symantec.com/SUPPORT/tsgeninfo.nsf/docid/199762382617?OpenDocument&src=sec_doc_nam"HowtomakeabackupoftheWindowsregistry.1.ClickStart>Run.2.Typeregedit3.ClickOK.Note:Iftheregistryeditorfailstoopenthethreatmayhavemodifiedtheregistrytopreventaccesstotheregistryeditor.SecurityResponsehasHYPERLINK"http://securityresponse.symantec.com/avcenter/venc/data/tool.to.reset.shellopencommand.registry.keys.html"developedatooltoresolvethisproblem.HYPERLINK"http://securityresponse.symantec.com/avcenter/venc/data/tool.to.reset.shellopencommand.registry.keys.html"Downloadandrunthistool,andthencontinuewiththeremoval.4.Navigatetoanddeletethefollowingregistryentries:oHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxCls\"ImagePath"="%System%\drivers\mrxcls.sys"oHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MRxNet\"ImagePath"="%System%\drivers\mrxnet.sys"5.ExittheRegistryEditor.Note:IftheriskcreatesormodifiesregistrysubkeysorentriesunderHKEY_CURRENT_USER,itispossiblethatitcreatedthemforeveryuseronthecompromisedcomputer.Toensurethatallregistrysubkeysorentriesareremovedorrestored,logonusingeachuseraccountandcheckforanyHKEY_CURRENT_USERitemslistedabove.6)禁止不必要的网络共享；7)增强用户的密码强度。/apps/media/inquira/resources/resources文章URLhttp://www.symantec.com/docs/TECH142348点击‘管理员’--‘服务器’后SEPM会变得非常慢文章:TECH142730|创建日期:2010-10-27|更新日期:2011-03-11文章类型TechnicalSolution产品HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=54619"EndpointProtection->11.0->11.0RU6MP1环境Microsoft->WindowsServer2003->StandardServer语言中文(简体)(Simp.Chinese)Problem从RU5升级至RU6MP1，点击‘管理员’--‘服务器’后SEPM会变得非常慢，点击其他选项也会相应的变慢很多。关闭SEPM重新登录后会正常，但在此点击‘服务器’后仍会变慢。Cause点击‘管理员’--‘服务器’前日志窗口并未激活，第一次点击后会激活，即使点击其他按钮，如‘客户端’、‘策略’也仍然继续加载所有日志，使得响应变慢。Solution此问题在RU6MP2中修复。有个workaround的方法：点击‘管理员’--‘服务器’变慢后，尝试点击‘管理员’--‘域’或‘安装包’或‘Adminstrator’可终止日志加载使SEPM正常。RelatedArticles文章URLhttp://www.symantec.com/docs/TECH142730非受管SEP客户端无法更新定义文章:TECH143240|创建日期:2010-11-02|更新日期:2011-03-11文章类型TechnicalSolution产品HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=54619"EndpointProtection->11.0->11.0RU6环境Microsoft->WindowsServer2003->StandardServer语言中文(简体)(Simp.Chinese)Problem非受管客户端点击执行liveupdate时，立刻完成并报错LU1803。Solution添加删除程序中卸载Liveupdate3.3，然后使用LUSetup.exe安装liveupdate后，再次运行liveupdate即正常。文章URLhttp://www.symantec.com/docs/TECH143240SEP客户端无法下载病毒定义文章:TECH140151|创建日期:2010-09-17|更新日期:2011-03-11文章类型TechnicalSolution产品HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=54619"EndpointProtection->11.0语言中文(简体)(Simp.Chinese)ProblemSEP客户端可以下载策略，客户端图标绿点存在，但是无法更新病毒定义Error察看Sylinkdump存在以下报错09/0815:04:43[2052]Requestis:action=52&hostid=BCDD3AB00A8CF0D3017577F9403CA8E9&groupid=C4520DD10A8CF2290062A8D2C50E07C5&fn=[hex]7B43363044433233342D363546392D343637342D393441452D3632313538454643413433337D&cdn=[hex]54573030364350574B30303034&lun=[hex]74775F6B6174655F7775&udn=[hex]5457444F4D2E434F5250&lu=6&luseq=90415033,&lulasttriedseq=&lutargetseq=100907002&lucontentstate=009/0815:04:43[2052]URL:/secars/secars.dll?h=9B9A04EC3C9684BAE76EF452E65E8B5B228E1FE332FA4473B553F23254C1B2378EA2043886B3B87D5019CE205AEB02DCE8650EAA71F5232C6769A149B958985AFF487F6D85B4124208CB6B58E4D4421CD462625DBCD100D96A568FCA26ACFCA990ED04CD0F0F8293724EA506E96E9F8D49304AC83CA1F7B53D1BA51BA805BEF60925B5E1DB9B49D7B4C0C9C76D96B31339E9F8A7ADC5F4D13C1CDA5D6F8D20B6BAE494D5D37C6EA2F967CB311E69A59957224D7AC2FB4668F5E7762F0CBB92897E4FB8550E549F54E9D5CCB51E8BD4A6D668A624779294E7771B47686E7DF8EEB46998606FC051211514BA525BEDCFF19E5849E9FD33FD87D7A98EACDB19D3E44C05FB521C76C7B71A2FE8EA10DB6727F328A0DCDEE97B88714D8CCE574D2A8347CFC5680B17D3835D06A9E043DFA76768B69FE285455D6D7BFB85D9447BD62BA3318A433D5EC6015390E30A115E6B71D37BA4D0A357D4159F2B966F4B59EFDC94B2606E003D0896D52B3A2F9CF2E01109/0815:04:43[2052]http://10.140.240.211:80/secars/secars.dll?h=9B9A04EC3C9684BAE76EF452E65E8B5B228E1FE332FA4473B553F23254C1B2378EA2043886B3B87D5019CE205AEB02DCE8650EAA71F5232C6769A149B958985AFF487F6D85B4124208CB6B58E4D4421CD462625DBCD100D96A568FCA26ACFCA990ED04CD0F0F8293724EA506E96E9F8D49304AC83CA1F7B53D1BA51BA805BEF60925B5E1DB9B49D7B4C0C9C76D96B31339E9F8A7ADC5F4D13C1CDA5D6F8D20B6BAE494D5D37C6EA2F967CB311E69A59957224D7AC2FB4668F5E7762F0CBB92897E4FB8550E549F54E9D5CCB51E8BD4A6D668A624779294E7771B47686E7DF8EEB46998606FC051211514BA525BEDCFF19E5849E9FD33FD87D7A98EACDB19D3E44C05FB521C76C7B71A2FE8EA10DB6727F328A0DCDEE97B88714D8CCE574D2A8347CFC5680B17D3835D06A9E043DFA76768B69FE285455D6D7BFB85D9447BD62BA3318A433D5EC6015390E30A115E6B71D37BA4D0A357D4159F2B966F4B59EFDC94B2606E003D0896D52B3A2F9CF2E01109/0815:04:43[2052]15:4:43=>SendHTTPREQUEST09/0815:04:43[2052]15:4:43=>HTTPREQUESTsent09/0815:04:43[2052]SMSreturn=20009/0815:04:43[2052]200=>200OK09/0815:05:13[2052]AH:(InetWaiting)timeout.Timeoutperiod:3000009/0815:05:13[2052]ThrowInternetException,ErrorCode=4294967287;InternetSessionTimeout09/0815:05:13[2052]CInternetException::09/0815:05:13[2052]RequestTimedoutwithWaittime(inms):30000Settingthesessiontimeoutto2min.Environmentwindowsxpsp3,IE7CauseIE6升级IE7,导致http设置在升级时出现损坏Solution1。确认IE设置菜单栏--工具--internetoption--高级中需要选择http1.1设置2。删除相关注册表键值，重起操作系统HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\InternetSettings\Connections/apps/media/inquira/resources/resources文章URLhttp://www.symantec.com/docs/TECH140151SEPM升级后更新不成功文章:TECH143414|创建日期:2010-11-04|更新日期:2011-03-11文章类型TechnicalSolution产品HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=54619"EndpointProtection->11.0->11.0RU6MP1HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=54619"EndpointProtection->11.0环境Microsoft->WindowsServer2003->StandardServer语言中文(简体)(Simp.Chinese)Problem从MR4升级到RU6MP1后，SEPM更新不成功提示返回值4。Solution添加删除程序中删除liveupdate3.3。删除文件夹c:\documentsandsettings\alluser\applicationdata\symantec\liveupdate。使用lusetup.exe重新安装liveupdate后执行liveupdate仍然返回代码4，但在c:\documentsandsettings\alluser\applicationdata\symantec\liveupdate\download可看到已经有下载的内容了。修改settings.liveupdate中PREFERENCES\INTERNET_CONNECT_TIMEOUT和PREFERENCES\INTERNET_READ_DATA_TIMEOUT的值，从45改为300，再次执行liveupdate即可成功。文章URLhttp://www.symantec.com/docs/TECH143414利用MR4的备份数据库恢复的SEPM（SymantecEndpointProtectionManager）病毒定义过期但是无法升级，运行LUALL.EXE时显示病毒定义已经是最新的。文章:TECH143630|创建日期:2010-11-08|更新日期:2011-03-11文章类型TechnicalSolution产品HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=54619"EndpointProtection->11.0->11.0MR4(11.0.4)语言中文(简体)(Simp.Chinese)ProblemSEPM的病毒定义已经过期，但运行LUALL时提示病毒定义已经是最新的，无需升级。Error1，SEPM病毒定义无法升级（互联网访问正常，SEPM服务器可以访问Symantec病毒定义下载网站）；2，运行Lucatalog修复后，重新启动服务器故障依旧；3，尝试运行补丁修复程序：SEPServerPatch-v6.01.exe，SEPServerPatch-v5.01.exe提示“无法在该服务器上运行”。Environment1，SEPM版本MR4；2，SEPM服务器重新安装，SEPM通过备份数据库恢复得到（备份的SEPM版本为MR4，恢复后的SEPM版本不变）。Solution1，将SEPM从MR4版本升级为RU6；2，重新配置SEPM服务器。/apps/media/inquira/resources/resources文章URLhttp://www.symantec.com/docs/TECH143630SEPM上找不到新安装的客户端文章:TECH144033|创建日期:2010-11-12|更新日期:2011-03-11文章类型TechnicalSolution产品HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=54619"EndpointProtection->11.0->11.0RU5环境Microsoft->WindowsServer2003->StandardServer语言中文(简体)(Simp.Chinese)Problem通过部署向导安装客户端后，客户端上有绿点，显示的组不是安装包导出的组。在SEPM上相应的组中找不到这个客户端，也搜寻不到。Solution在数据库的sem_client中按照计算机名称可查到这个客户端的记录，但对应的policymode=0，而且还有一些客户端的policymode也为0。安装包确认导出时使用的是计算机模式，但手动对客户端操作时将其转为了用户模式，使得新安装的客户端出现异常。使用工具将用户模式的客户端都先转为计算机模式，然后使客户端重新注册，则其出现在正确的组当中。文章URLhttp://www.symantec.com/docs/TECH144033使用.jdb文件更新SEPM病毒定义失败文章:TECH141965|创建日期:2010-10-15|更新日期:2011-03-11文章类型TechnicalSolution产品HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=54619"EndpointProtection->11.0->11.0RU5->11.0RU5(HostedEndpoint)语言中文(简体)(Simp.Chinese)Problem由于用户的SEPM无法访问Internet，所以使用.jdb文件来更新SEPM的病毒定义。用户把.jdb文件下载后存储在C:\ProgramFiles\Symantec\SymantecEndpointProtectionManager\data\inbox\content\incoming，能看到.jdb文件已经被解压缩并处理，但在SEPM上显示防病毒和防间谍软件的定义并没有被更新，SEP客户端也无法得到最新的病毒定义。EnvironmentPlatform:Windows7ProfessionalSEPversion:11.0.RU5Cause很可能是由于Symcdata或VirusDefs中的文件损坏。Solution打开控制面板>管理工具>服务>找到SymantecEndpointProtectionManager>停止此服务同时停止SymantecEndpointProtection服务.打开目录\ProgramFiles\Symantec\SymantecEndpointProtectionManager\data\inbox\content\incoming删除所有的.jdb文件以及其他释放出的文件打开目录\ProgramFiles\CommonFiles\SymantecShared\Symcdata-删除sesmvirdefs32和sesmvirdefs64中的所有文件-删除VirusDefs中的所有文件打开控制面板>管理工具>服务>找到SymantecEndpointProtectionManager>启动此服务启动SymantecEndpointProtection服务再次把.jdb文件存放到\ProgramFiles\Symantec\SymantecEndpointProtectionManager\data\inbox\content\incoming查看是否SEPM能够成功升级病毒定义/apps/media/inquira/resources/resourcesRelatedArticles文章URLhttp://www.symantec.com/docs/TECH141965SymantecEndpointProtection(SEP)11.0中的LiveUpdate故障补救文章:TECH102787|创建日期:2008-01-05|更新日期:2008-01-07文章类型TechnicalSolution产品HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=55357"EndpointProtectionSmallBusinessEdition->11.0HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=54619"EndpointProtection->11.0环境Microsoft->WindowsXP->Home5.1Microsoft->Windows2000->Professional语言Deutsch(German)EnglishEspañolHYPERLINK"javascript:;"显示全部FrançaisItalianoPortuguêsBrasiliero中文(简体)(Simp.Chinese)中文(繁體)(Trad.Chinese)HYPERLINK"javascript:;"显示部分ProblemLiveUpdate可以运行，但不能更新定义。Cause...\DocumentsandSettings\AllUsers\ApplicationData\Symantec\LiveUpdate文件夹损坏Solution要解决此问题，请遵循以下各步骤：启动“Windows资源管理器”（或“我的电脑”），并导航到以下位置：\DocumentsandSettings\AllUsers\ApplicationData\Symantec\LiveUpdate在LiveUpdate文件夹中，将所有Settings.LiveUpdate文件剪切并复制到另一个文件夹作为备份。在同一个文件夹中，删除Log.LiveUpdate文件。删除Downloads文件夹中的内容。（不要删除\Downloads文件夹本身）重新运行LiveUpdate。如果问题仍然没有解决，则您需要卸载并重新安装LiveUpdate。有关详细信息，请参考以下文档：HYPERLINK"http://service1.symantec.com/support/ent-security.nsf/docid/2007100907303548"如何在安装了SymantecEndpointProtectionManager或SymantecEndpointProtection客户端时卸载并重新安装LiveUpdateReferencesSymantecAntiVirusCase#290-882-156TechnicalInformation如果补救过程失败，则请客户转发新的Log.LiveUpdate文件，以便查看/apps/media/inquira/resources/resources文章URLhttp://www.symantec.com/docs/TECH102787HowtoUninstallandReinstallLiveUpdateWhenaSymantecEndpointProtectionManagerorSymantecEndpointProtectionClientisInstalledArticle:TECH102609|Created:2007-01-09|Updated:2010-08-13ArticleTypeTechnicalSolutionProduct(s)HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=55357"EndpointProtectionSmallBusinessEdition->11.0HYPERLINK"http://www.symantec.com/business/support/index?page=landing&key=54619"EndpointProtection->11.0EnvironmentMicrosoft->WindowsXP->Home5.1Microsoft->WindowsVista->Enterprise6.0.6000Microsoft->WindowsServer2003->StandardServerHYPERLINK"javascript:;"ShowallMicrosoft->Windows2000->ProfessionalHYPERLINK"javascript:;"ShowlessLanguagesEnglishEspañol日本語(Japanese)HYPERLINK"javascript:;"Showall中文(简体)(Simp.Chinese)中文(繁體)(Trad.Chinese)HYPERLINK"javascript:;"ShowlessProblemYouneedtouninstallandreinstallSymantecLiveUpdateonacomputerwhereSymantecEndpointProtectionManager(SEPM)oraSymantecEndpointProtection(SEP)clientisinstalled.SolutionUseAddorRemoveProgramsintheControlPaneltouninstallLiveUpdate.RuntheLiveUpdateinstallertoinstallLiveUpdateagain.TouninstallandreinstallLiveUpdate:InWindowsExplorermakeaback-upcopyofthefollowingfiles:OnWindows2000,XPand2003:C:\DocumentsandSettings\AllUsers\ApplicationData\Symantec\LiveUpdate\Product.Inventory.LiveUpdateC:\DocumentsandSettings\AllUsers\ApplicationData\Symantec\LiveUpdate\Settings.LiveUpdateOnWindowsVista,7and2008:C:\ProgramData\Symantec\LiveUpdate\Product.Inventory.LiveUpdateC:\Users\AllUsers\ApplicationData\Symantec\LiveUpdate\Settings.LiveUpdateWARNING:ItisimportanttofollowthisstepinordertoavoidhavingtoregisterSEPMorSEPwithLiveUpdateorhavingtoreconfigureLiveUpdateproxysettings.ClickStart>Settings>ControlPanel.ClickAddorRemovePrograms.ClickLiveUpdate.ClickChange/Remove.Followtheon-screeninstructionstouninstallLiveUpdate.InWindowsExplorer,deletethefollowingfoldersiftheyarepresent:OnWindows2000,XPand2003:C:\DocumentsandSettings\AllUsers\ApplicationData\Symantec\LiveUpdateC:\ProgramFiles\Symantec\LiveUpdateOnWindowsVista,7and2008:C:\ProgramData\Symantec\LiveUpdate\C:\Users\AllUsers\ApplicationData\Symantec\LiveUpdateInstallLiveUpdateusingLUSETUP.EXElocatedintheSEPinstallationfiles,inoneofthefollowingfolders:...CD1